2009-03-30 13:32:28 +00:00
|
|
|
// Copyright 2009 the V8 project authors. All rights reserved.
|
2008-07-03 15:10:15 +00:00
|
|
|
// Redistribution and use in source and binary forms, with or without
|
|
|
|
// modification, are permitted provided that the following conditions are
|
|
|
|
// met:
|
|
|
|
//
|
|
|
|
// * Redistributions of source code must retain the above copyright
|
|
|
|
// notice, this list of conditions and the following disclaimer.
|
|
|
|
// * Redistributions in binary form must reproduce the above
|
|
|
|
// copyright notice, this list of conditions and the following
|
|
|
|
// disclaimer in the documentation and/or other materials provided
|
|
|
|
// with the distribution.
|
|
|
|
// * Neither the name of Google Inc. nor the names of its
|
|
|
|
// contributors may be used to endorse or promote products derived
|
|
|
|
// from this software without specific prior written permission.
|
|
|
|
//
|
|
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
|
|
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
|
|
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
|
|
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
|
|
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
|
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
|
|
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
|
|
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
|
|
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
|
|
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
|
|
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
|
|
|
|
#include "v8.h"
|
|
|
|
|
|
|
|
#include "accessors.h"
|
|
|
|
#include "api.h"
|
|
|
|
#include "bootstrapper.h"
|
|
|
|
#include "compiler.h"
|
|
|
|
#include "debug.h"
|
|
|
|
#include "execution.h"
|
|
|
|
#include "global-handles.h"
|
|
|
|
#include "natives.h"
|
|
|
|
#include "runtime.h"
|
|
|
|
|
2009-05-25 10:05:56 +00:00
|
|
|
namespace v8 {
|
|
|
|
namespace internal {
|
2008-07-03 15:10:15 +00:00
|
|
|
|
|
|
|
|
2009-01-23 17:22:23 +00:00
|
|
|
v8::ImplementationUtilities::HandleScopeData HandleScope::current_ =
|
|
|
|
{ -1, NULL, NULL };
|
|
|
|
|
|
|
|
|
|
|
|
int HandleScope::NumberOfHandles() {
|
|
|
|
int n = HandleScopeImplementer::instance()->Blocks()->length();
|
|
|
|
if (n == 0) return 0;
|
|
|
|
return ((n - 1) * kHandleBlockSize) +
|
|
|
|
(current_.next - HandleScopeImplementer::instance()->Blocks()->last());
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-03-18 18:50:35 +00:00
|
|
|
void** HandleScope::Extend() {
|
2009-01-23 17:22:23 +00:00
|
|
|
void** result = current_.next;
|
|
|
|
|
2009-03-18 18:50:35 +00:00
|
|
|
ASSERT(result == current_.limit);
|
|
|
|
// Make sure there's at least one scope on the stack and that the
|
|
|
|
// top of the scope stack isn't a barrier.
|
|
|
|
if (current_.extensions < 0) {
|
|
|
|
Utils::ReportApiFailure("v8::HandleScope::CreateHandle()",
|
|
|
|
"Cannot create a handle without a HandleScope");
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
HandleScopeImplementer* impl = HandleScopeImplementer::instance();
|
|
|
|
// If there's more room in the last block, we use that. This is used
|
|
|
|
// for fast creation of scopes after scope barriers.
|
|
|
|
if (!impl->Blocks()->is_empty()) {
|
|
|
|
void** limit = &impl->Blocks()->last()[kHandleBlockSize];
|
|
|
|
if (current_.limit != limit) {
|
|
|
|
current_.limit = limit;
|
2009-01-23 17:22:23 +00:00
|
|
|
}
|
|
|
|
}
|
2009-03-18 21:14:46 +00:00
|
|
|
|
2009-03-18 18:50:35 +00:00
|
|
|
// If we still haven't found a slot for the handle, we extend the
|
|
|
|
// current handle scope by allocating a new handle block.
|
|
|
|
if (result == current_.limit) {
|
|
|
|
// If there's a spare block, use it for growing the current scope.
|
|
|
|
result = impl->GetSpareOrNewBlock();
|
|
|
|
// Add the extension to the global list of blocks, but count the
|
|
|
|
// extension as part of the current scope.
|
|
|
|
impl->Blocks()->Add(result);
|
|
|
|
current_.extensions++;
|
|
|
|
current_.limit = &result[kHandleBlockSize];
|
|
|
|
}
|
2009-01-23 17:22:23 +00:00
|
|
|
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void HandleScope::DeleteExtensions() {
|
|
|
|
ASSERT(current_.extensions != 0);
|
|
|
|
HandleScopeImplementer::instance()->DeleteExtensions(current_.extensions);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void HandleScope::ZapRange(void** start, void** end) {
|
|
|
|
if (start == NULL) return;
|
|
|
|
for (void** p = start; p < end; p++) {
|
|
|
|
*p = reinterpret_cast<void*>(v8::internal::kHandleZapValue);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2008-07-03 15:10:15 +00:00
|
|
|
Handle<FixedArray> AddKeysFromJSArray(Handle<FixedArray> content,
|
|
|
|
Handle<JSArray> array) {
|
|
|
|
CALL_HEAP_FUNCTION(content->AddKeysFromJSArray(*array), FixedArray);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<FixedArray> UnionOfKeys(Handle<FixedArray> first,
|
|
|
|
Handle<FixedArray> second) {
|
|
|
|
CALL_HEAP_FUNCTION(first->UnionOfKeys(*second), FixedArray);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
Split window support from V8.
Here is a description of the background and design of split window in Chrome and V8:
https://docs.google.com/a/google.com/Doc?id=chhjkpg_47fwddxbfr
This change list splits the window object into two parts: 1) an inner window object used as the global object of contexts; 2) an outer window object exposed to JavaScript and accessible by the name 'window'. Firefox did it awhile ago, here are some discussions: https://wiki.mozilla.org/Gecko:SplitWindow. One additional benefit of splitting window in Chrome is that accessing global variables don't need security checks anymore, it can improve applications that use many global variables.
V8 support of split window:
There are a small number of changes on V8 api to support split window:
Security context is removed from V8, so does related API functions;
A global object can be detached from its context and reused by a new context;
Access checks on an object template can be turned on/off by default;
An object can turn on its access checks later;
V8 has a new object type, ApiGlobalObject, which is the outer window object type. The existing JSGlobalObject becomes the inner window object type. Security checks are moved from JSGlobalObject to ApiGlobalObject. ApiGlobalObject is the one exposed to JavaScript, it is accessible through Context::Global(). ApiGlobalObject's prototype is set to JSGlobalObject so that property lookups are forwarded to JSGlobalObject. ApiGlobalObject forwards all other property access requests to JSGlobalObject, such as SetProperty, DeleteProperty, etc.
Security token is moved to a global context, and ApiGlobalObject has a reference to its global context. JSGlobalObject has a reference to its global context as well. When accessing properties on a global object in JavaScript, the domain security check is performed by comparing the security token of the lexical context (Top::global_context()) to the token of global object's context. The check is only needed when the receiver is a window object, such as 'window.document'. Accessing global variables, such as 'var foo = 3; foo' does not need checks because the receiver is the inner window object.
When an outer window is detached from its global context (when a frame navigates away from a page), it is completely detached from the inner window. A new context is created for the new page, and the outer global object is reused. At this point, the access check on the DOMWindow wrapper of the old context is turned on. The code in old context is still able to access DOMWindow properties, but it has to go through domain security checks.
It is debatable on how to implement the outer window object. Currently each property access function has to check if the receiver is ApiGlobalObject type. This approach might be error-prone that one may forget to check the receiver when adding new functions. It is unlikely a performance issue because accessing global variables are more common than 'window.foo' style coding.
I am still working on the ARM port, and I'd like to hear comments and suggestions on the best way to support it in V8.
Review URL: http://codereview.chromium.org/7366
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@540 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-21 19:07:58 +00:00
|
|
|
Handle<JSGlobalProxy> ReinitializeJSGlobalProxy(
|
2008-07-03 15:10:15 +00:00
|
|
|
Handle<JSFunction> constructor,
|
Split window support from V8.
Here is a description of the background and design of split window in Chrome and V8:
https://docs.google.com/a/google.com/Doc?id=chhjkpg_47fwddxbfr
This change list splits the window object into two parts: 1) an inner window object used as the global object of contexts; 2) an outer window object exposed to JavaScript and accessible by the name 'window'. Firefox did it awhile ago, here are some discussions: https://wiki.mozilla.org/Gecko:SplitWindow. One additional benefit of splitting window in Chrome is that accessing global variables don't need security checks anymore, it can improve applications that use many global variables.
V8 support of split window:
There are a small number of changes on V8 api to support split window:
Security context is removed from V8, so does related API functions;
A global object can be detached from its context and reused by a new context;
Access checks on an object template can be turned on/off by default;
An object can turn on its access checks later;
V8 has a new object type, ApiGlobalObject, which is the outer window object type. The existing JSGlobalObject becomes the inner window object type. Security checks are moved from JSGlobalObject to ApiGlobalObject. ApiGlobalObject is the one exposed to JavaScript, it is accessible through Context::Global(). ApiGlobalObject's prototype is set to JSGlobalObject so that property lookups are forwarded to JSGlobalObject. ApiGlobalObject forwards all other property access requests to JSGlobalObject, such as SetProperty, DeleteProperty, etc.
Security token is moved to a global context, and ApiGlobalObject has a reference to its global context. JSGlobalObject has a reference to its global context as well. When accessing properties on a global object in JavaScript, the domain security check is performed by comparing the security token of the lexical context (Top::global_context()) to the token of global object's context. The check is only needed when the receiver is a window object, such as 'window.document'. Accessing global variables, such as 'var foo = 3; foo' does not need checks because the receiver is the inner window object.
When an outer window is detached from its global context (when a frame navigates away from a page), it is completely detached from the inner window. A new context is created for the new page, and the outer global object is reused. At this point, the access check on the DOMWindow wrapper of the old context is turned on. The code in old context is still able to access DOMWindow properties, but it has to go through domain security checks.
It is debatable on how to implement the outer window object. Currently each property access function has to check if the receiver is ApiGlobalObject type. This approach might be error-prone that one may forget to check the receiver when adding new functions. It is unlikely a performance issue because accessing global variables are more common than 'window.foo' style coding.
I am still working on the ARM port, and I'd like to hear comments and suggestions on the best way to support it in V8.
Review URL: http://codereview.chromium.org/7366
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@540 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-21 19:07:58 +00:00
|
|
|
Handle<JSGlobalProxy> global) {
|
|
|
|
CALL_HEAP_FUNCTION(Heap::ReinitializeJSGlobalProxy(*constructor, *global),
|
|
|
|
JSGlobalProxy);
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void SetExpectedNofProperties(Handle<JSFunction> func, int nof) {
|
|
|
|
func->shared()->set_expected_nof_properties(nof);
|
|
|
|
if (func->has_initial_map()) {
|
|
|
|
Handle<Map> new_initial_map =
|
2008-08-27 13:47:52 +00:00
|
|
|
Factory::CopyMapDropTransitions(Handle<Map>(func->initial_map()));
|
2008-07-03 15:10:15 +00:00
|
|
|
new_initial_map->set_unused_property_fields(nof);
|
|
|
|
func->set_initial_map(*new_initial_map);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void SetPrototypeProperty(Handle<JSFunction> func, Handle<JSObject> value) {
|
|
|
|
CALL_HEAP_FUNCTION_VOID(func->SetPrototype(*value));
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2008-10-03 09:16:12 +00:00
|
|
|
static int ExpectedNofPropertiesFromEstimate(int estimate) {
|
2008-07-03 15:10:15 +00:00
|
|
|
// TODO(1231235): We need dynamic feedback to estimate the number
|
|
|
|
// of expected properties in an object. The static hack below
|
|
|
|
// is barely a solution.
|
2008-10-03 09:16:12 +00:00
|
|
|
if (estimate == 0) return 4;
|
|
|
|
return estimate + 2;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void SetExpectedNofPropertiesFromEstimate(Handle<SharedFunctionInfo> shared,
|
|
|
|
int estimate) {
|
|
|
|
shared->set_expected_nof_properties(
|
|
|
|
ExpectedNofPropertiesFromEstimate(estimate));
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void SetExpectedNofPropertiesFromEstimate(Handle<JSFunction> func,
|
|
|
|
int estimate) {
|
2008-10-03 09:16:12 +00:00
|
|
|
SetExpectedNofProperties(
|
|
|
|
func, ExpectedNofPropertiesFromEstimate(estimate));
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-01-12 10:59:58 +00:00
|
|
|
void NormalizeProperties(Handle<JSObject> object,
|
|
|
|
PropertyNormalizationMode mode) {
|
|
|
|
CALL_HEAP_FUNCTION_VOID(object->NormalizeProperties(mode));
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void NormalizeElements(Handle<JSObject> object) {
|
|
|
|
CALL_HEAP_FUNCTION_VOID(object->NormalizeElements());
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void TransformToFastProperties(Handle<JSObject> object,
|
|
|
|
int unused_property_fields) {
|
|
|
|
CALL_HEAP_FUNCTION_VOID(
|
|
|
|
object->TransformToFastProperties(unused_property_fields));
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void FlattenString(Handle<String> string) {
|
2009-03-17 09:33:06 +00:00
|
|
|
CALL_HEAP_FUNCTION_VOID(string->TryFlattenIfNotFlat());
|
|
|
|
ASSERT(string->IsFlat());
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<Object> SetPrototype(Handle<JSFunction> function,
|
|
|
|
Handle<Object> prototype) {
|
|
|
|
CALL_HEAP_FUNCTION(Accessors::FunctionSetPrototype(*function,
|
|
|
|
*prototype,
|
|
|
|
NULL),
|
|
|
|
Object);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<Object> SetProperty(Handle<JSObject> object,
|
|
|
|
Handle<String> key,
|
|
|
|
Handle<Object> value,
|
|
|
|
PropertyAttributes attributes) {
|
|
|
|
CALL_HEAP_FUNCTION(object->SetProperty(*key, *value, attributes), Object);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<Object> SetProperty(Handle<Object> object,
|
|
|
|
Handle<Object> key,
|
|
|
|
Handle<Object> value,
|
|
|
|
PropertyAttributes attributes) {
|
2008-10-02 13:45:21 +00:00
|
|
|
CALL_HEAP_FUNCTION(
|
|
|
|
Runtime::SetObjectProperty(object, key, value, attributes), Object);
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-04-21 13:28:11 +00:00
|
|
|
Handle<Object> ForceSetProperty(Handle<JSObject> object,
|
|
|
|
Handle<Object> key,
|
|
|
|
Handle<Object> value,
|
|
|
|
PropertyAttributes attributes) {
|
|
|
|
CALL_HEAP_FUNCTION(
|
|
|
|
Runtime::ForceSetObjectProperty(object, key, value, attributes), Object);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-06-08 09:46:09 +00:00
|
|
|
Handle<Object> ForceDeleteProperty(Handle<JSObject> object,
|
|
|
|
Handle<Object> key) {
|
|
|
|
CALL_HEAP_FUNCTION(Runtime::ForceDeleteObjectProperty(object, key), Object);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-04-16 12:58:14 +00:00
|
|
|
Handle<Object> IgnoreAttributesAndSetLocalProperty(
|
|
|
|
Handle<JSObject> object,
|
|
|
|
Handle<String> key,
|
|
|
|
Handle<Object> value,
|
|
|
|
PropertyAttributes attributes) {
|
2008-10-02 13:45:21 +00:00
|
|
|
CALL_HEAP_FUNCTION(object->
|
|
|
|
IgnoreAttributesAndSetLocalProperty(*key, *value, attributes), Object);
|
|
|
|
}
|
|
|
|
|
2009-06-08 09:46:09 +00:00
|
|
|
|
2008-07-03 15:10:15 +00:00
|
|
|
Handle<Object> SetPropertyWithInterceptor(Handle<JSObject> object,
|
|
|
|
Handle<String> key,
|
|
|
|
Handle<Object> value,
|
|
|
|
PropertyAttributes attributes) {
|
|
|
|
CALL_HEAP_FUNCTION(object->SetPropertyWithInterceptor(*key,
|
|
|
|
*value,
|
|
|
|
attributes),
|
|
|
|
Object);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<Object> GetProperty(Handle<JSObject> obj,
|
|
|
|
const char* name) {
|
|
|
|
Handle<String> str = Factory::LookupAsciiSymbol(name);
|
|
|
|
CALL_HEAP_FUNCTION(obj->GetProperty(*str), Object);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<Object> GetProperty(Handle<Object> obj,
|
|
|
|
Handle<Object> key) {
|
2008-08-28 09:55:41 +00:00
|
|
|
CALL_HEAP_FUNCTION(Runtime::GetObjectProperty(obj, key), Object);
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<Object> GetPropertyWithInterceptor(Handle<JSObject> receiver,
|
|
|
|
Handle<JSObject> holder,
|
|
|
|
Handle<String> name,
|
|
|
|
PropertyAttributes* attributes) {
|
|
|
|
CALL_HEAP_FUNCTION(holder->GetPropertyWithInterceptor(*receiver,
|
|
|
|
*name,
|
|
|
|
attributes),
|
|
|
|
Object);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<Object> GetPrototype(Handle<Object> obj) {
|
|
|
|
Handle<Object> result(obj->GetPrototype());
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-03-19 18:50:00 +00:00
|
|
|
Handle<Object> GetHiddenProperties(Handle<JSObject> obj,
|
|
|
|
bool create_if_needed) {
|
2009-05-12 22:07:10 +00:00
|
|
|
Handle<String> key = Factory::hidden_symbol();
|
|
|
|
|
|
|
|
if (obj->HasFastProperties()) {
|
|
|
|
// If the object has fast properties, check whether the first slot
|
|
|
|
// in the descriptor array matches the hidden symbol. Since the
|
|
|
|
// hidden symbols hash code is zero (and no other string has hash
|
|
|
|
// code zero) it will always occupy the first entry if present.
|
|
|
|
DescriptorArray* descriptors = obj->map()->instance_descriptors();
|
2009-07-10 19:25:18 +00:00
|
|
|
if ((descriptors->number_of_descriptors() > 0) &&
|
|
|
|
(descriptors->GetKey(0) == *key) &&
|
|
|
|
descriptors->IsProperty(0)) {
|
|
|
|
ASSERT(descriptors->GetType(0) == FIELD);
|
|
|
|
return Handle<Object>(obj->FastPropertyAt(descriptors->GetFieldIndex(0)));
|
2009-05-12 22:07:10 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Only attempt to find the hidden properties in the local object and not
|
|
|
|
// in the prototype chain. Note that HasLocalProperty() can cause a GC in
|
|
|
|
// the general case in the presence of interceptors.
|
|
|
|
if (!obj->HasLocalProperty(*key)) {
|
|
|
|
// Hidden properties object not found. Allocate a new hidden properties
|
|
|
|
// object if requested. Otherwise return the undefined value.
|
|
|
|
if (create_if_needed) {
|
|
|
|
Handle<Object> hidden_obj = Factory::NewJSObject(Top::object_function());
|
|
|
|
return SetProperty(obj, key, hidden_obj, DONT_ENUM);
|
|
|
|
} else {
|
|
|
|
return Factory::undefined_value();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return GetProperty(obj, key);
|
2009-03-19 18:50:00 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2008-07-03 15:10:15 +00:00
|
|
|
Handle<Object> DeleteElement(Handle<JSObject> obj,
|
|
|
|
uint32_t index) {
|
2009-06-08 09:46:09 +00:00
|
|
|
CALL_HEAP_FUNCTION(obj->DeleteElement(index, JSObject::NORMAL_DELETION),
|
|
|
|
Object);
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<Object> DeleteProperty(Handle<JSObject> obj,
|
|
|
|
Handle<String> prop) {
|
2009-06-08 09:46:09 +00:00
|
|
|
CALL_HEAP_FUNCTION(obj->DeleteProperty(*prop, JSObject::NORMAL_DELETION),
|
|
|
|
Object);
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2008-08-29 08:48:06 +00:00
|
|
|
Handle<Object> LookupSingleCharacterStringFromCode(uint32_t index) {
|
|
|
|
CALL_HEAP_FUNCTION(Heap::LookupSingleCharacterStringFromCode(index), Object);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2008-07-03 15:10:15 +00:00
|
|
|
Handle<String> SubString(Handle<String> str, int start, int end) {
|
2008-11-05 10:26:08 +00:00
|
|
|
CALL_HEAP_FUNCTION(str->Slice(start, end), String);
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<Object> SetElement(Handle<JSObject> object,
|
|
|
|
uint32_t index,
|
|
|
|
Handle<Object> value) {
|
2008-08-28 09:55:41 +00:00
|
|
|
CALL_HEAP_FUNCTION(object->SetElement(index, *value), Object);
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2008-10-22 08:21:18 +00:00
|
|
|
Handle<JSObject> Copy(Handle<JSObject> obj) {
|
|
|
|
CALL_HEAP_FUNCTION(Heap::CopyJSObject(*obj), JSObject);
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Wrappers for scripts are kept alive and cached in weak global
|
|
|
|
// handles referred from proxy objects held by the scripts as long as
|
|
|
|
// they are used. When they are not used anymore, the garbage
|
|
|
|
// collector will call the weak callback on the global handle
|
|
|
|
// associated with the wrapper and get rid of both the wrapper and the
|
|
|
|
// handle.
|
2008-10-23 08:25:23 +00:00
|
|
|
static void ClearWrapperCache(Persistent<v8::Value> handle, void*) {
|
2009-03-30 13:32:28 +00:00
|
|
|
#ifdef ENABLE_HEAP_PROTECTION
|
|
|
|
// Weak reference callbacks are called as if from outside V8. We
|
|
|
|
// need to reeenter to unprotect the heap.
|
|
|
|
VMState state(OTHER);
|
|
|
|
#endif
|
2008-07-03 15:10:15 +00:00
|
|
|
Handle<Object> cache = Utils::OpenHandle(*handle);
|
|
|
|
JSValue* wrapper = JSValue::cast(*cache);
|
|
|
|
Proxy* proxy = Script::cast(wrapper->value())->wrapper();
|
|
|
|
ASSERT(proxy->proxy() == reinterpret_cast<Address>(cache.location()));
|
|
|
|
proxy->set_proxy(0);
|
|
|
|
GlobalHandles::Destroy(cache.location());
|
|
|
|
Counters::script_wrappers.Decrement();
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<JSValue> GetScriptWrapper(Handle<Script> script) {
|
2009-07-07 11:41:21 +00:00
|
|
|
if (script->wrapper()->proxy() != NULL) {
|
2008-07-03 15:10:15 +00:00
|
|
|
// Return the script wrapper directly from the cache.
|
2009-07-07 11:41:21 +00:00
|
|
|
return Handle<JSValue>(
|
|
|
|
reinterpret_cast<JSValue**>(script->wrapper()->proxy()));
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Construct a new script wrapper.
|
|
|
|
Counters::script_wrappers.Increment();
|
|
|
|
Handle<JSFunction> constructor = Top::script_function();
|
|
|
|
Handle<JSValue> result =
|
|
|
|
Handle<JSValue>::cast(Factory::NewJSObject(constructor));
|
|
|
|
result->set_value(*script);
|
|
|
|
|
|
|
|
// Create a new weak global handle and use it to cache the wrapper
|
|
|
|
// for future use. The cache will automatically be cleared by the
|
|
|
|
// garbage collector when it is not used anymore.
|
|
|
|
Handle<Object> handle = GlobalHandles::Create(*result);
|
|
|
|
GlobalHandles::MakeWeak(handle.location(), NULL, &ClearWrapperCache);
|
|
|
|
script->wrapper()->set_proxy(reinterpret_cast<Address>(handle.location()));
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-03-10 15:08:45 +00:00
|
|
|
// Init line_ends array with code positions of line ends inside script
|
|
|
|
// source.
|
|
|
|
void InitScriptLineEnds(Handle<Script> script) {
|
|
|
|
if (!script->line_ends()->IsUndefined()) return;
|
|
|
|
|
|
|
|
if (!script->source()->IsString()) {
|
|
|
|
ASSERT(script->source()->IsUndefined());
|
|
|
|
script->set_line_ends(*(Factory::NewJSArray(0)));
|
|
|
|
ASSERT(script->line_ends()->IsJSArray());
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
Handle<String> src(String::cast(script->source()));
|
|
|
|
const int src_len = src->length();
|
|
|
|
Handle<String> new_line = Factory::NewStringFromAscii(CStrVector("\n"));
|
|
|
|
|
|
|
|
// Pass 1: Identify line count.
|
|
|
|
int line_count = 0;
|
|
|
|
int position = 0;
|
|
|
|
while (position != -1 && position < src_len) {
|
|
|
|
position = Runtime::StringMatch(src, new_line, position);
|
|
|
|
if (position != -1) {
|
|
|
|
position++;
|
|
|
|
}
|
|
|
|
// Even if the last line misses a line end, it is counted.
|
|
|
|
line_count++;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Pass 2: Fill in line ends positions
|
|
|
|
Handle<FixedArray> array = Factory::NewFixedArray(line_count);
|
|
|
|
int array_index = 0;
|
|
|
|
position = 0;
|
|
|
|
while (position != -1 && position < src_len) {
|
|
|
|
position = Runtime::StringMatch(src, new_line, position);
|
|
|
|
// If the script does not end with a line ending add the final end
|
|
|
|
// position as just past the last line ending.
|
|
|
|
array->set(array_index++,
|
|
|
|
Smi::FromInt(position != -1 ? position++ : src_len));
|
|
|
|
}
|
|
|
|
ASSERT(array_index == line_count);
|
|
|
|
|
|
|
|
Handle<JSArray> object = Factory::NewJSArrayWithElements(array);
|
|
|
|
script->set_line_ends(*object);
|
|
|
|
ASSERT(script->line_ends()->IsJSArray());
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Convert code position into line number.
|
|
|
|
int GetScriptLineNumber(Handle<Script> script, int code_pos) {
|
|
|
|
InitScriptLineEnds(script);
|
|
|
|
AssertNoAllocation no_allocation;
|
|
|
|
JSArray* line_ends_array = JSArray::cast(script->line_ends());
|
|
|
|
const int line_ends_len = (Smi::cast(line_ends_array->length()))->value();
|
|
|
|
|
|
|
|
int line = -1;
|
|
|
|
if (line_ends_len > 0 &&
|
|
|
|
code_pos <= (Smi::cast(line_ends_array->GetElement(0)))->value()) {
|
|
|
|
line = 0;
|
|
|
|
} else {
|
|
|
|
for (int i = 1; i < line_ends_len; ++i) {
|
|
|
|
if ((Smi::cast(line_ends_array->GetElement(i - 1)))->value() < code_pos &&
|
|
|
|
code_pos <= (Smi::cast(line_ends_array->GetElement(i)))->value()) {
|
|
|
|
line = i;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return line != -1 ? line + script->line_offset()->value() : line;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2008-07-03 15:10:15 +00:00
|
|
|
// Compute the property keys from the interceptor.
|
|
|
|
v8::Handle<v8::Array> GetKeysForNamedInterceptor(Handle<JSObject> receiver,
|
|
|
|
Handle<JSObject> object) {
|
|
|
|
Handle<InterceptorInfo> interceptor(object->GetNamedInterceptor());
|
|
|
|
Handle<Object> data(interceptor->data());
|
|
|
|
v8::AccessorInfo info(
|
|
|
|
v8::Utils::ToLocal(receiver),
|
|
|
|
v8::Utils::ToLocal(data),
|
|
|
|
v8::Utils::ToLocal(object));
|
|
|
|
v8::Handle<v8::Array> result;
|
|
|
|
if (!interceptor->enumerator()->IsUndefined()) {
|
|
|
|
v8::NamedPropertyEnumerator enum_fun =
|
|
|
|
v8::ToCData<v8::NamedPropertyEnumerator>(interceptor->enumerator());
|
|
|
|
LOG(ApiObjectAccess("interceptor-named-enum", *object));
|
|
|
|
{
|
|
|
|
// Leaving JavaScript.
|
2009-03-27 12:32:28 +00:00
|
|
|
VMState state(EXTERNAL);
|
2008-07-03 15:10:15 +00:00
|
|
|
result = enum_fun(info);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Compute the element keys from the interceptor.
|
|
|
|
v8::Handle<v8::Array> GetKeysForIndexedInterceptor(Handle<JSObject> receiver,
|
|
|
|
Handle<JSObject> object) {
|
|
|
|
Handle<InterceptorInfo> interceptor(object->GetIndexedInterceptor());
|
|
|
|
Handle<Object> data(interceptor->data());
|
|
|
|
v8::AccessorInfo info(
|
|
|
|
v8::Utils::ToLocal(receiver),
|
|
|
|
v8::Utils::ToLocal(data),
|
|
|
|
v8::Utils::ToLocal(object));
|
|
|
|
v8::Handle<v8::Array> result;
|
|
|
|
if (!interceptor->enumerator()->IsUndefined()) {
|
|
|
|
v8::IndexedPropertyEnumerator enum_fun =
|
|
|
|
v8::ToCData<v8::IndexedPropertyEnumerator>(interceptor->enumerator());
|
|
|
|
LOG(ApiObjectAccess("interceptor-indexed-enum", *object));
|
|
|
|
{
|
|
|
|
// Leaving JavaScript.
|
2009-03-27 12:32:28 +00:00
|
|
|
VMState state(EXTERNAL);
|
2008-07-03 15:10:15 +00:00
|
|
|
result = enum_fun(info);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<FixedArray> GetKeysInFixedArrayFor(Handle<JSObject> object) {
|
|
|
|
Handle<FixedArray> content = Factory::empty_fixed_array();
|
|
|
|
|
|
|
|
JSObject* arguments_boilerplate =
|
|
|
|
Top::context()->global_context()->arguments_boilerplate();
|
|
|
|
JSFunction* arguments_function =
|
|
|
|
JSFunction::cast(arguments_boilerplate->map()->constructor());
|
|
|
|
bool allow_enumeration = (object->map()->constructor() != arguments_function);
|
|
|
|
|
|
|
|
// Only collect keys if access is permitted.
|
|
|
|
if (allow_enumeration) {
|
|
|
|
for (Handle<Object> p = object;
|
|
|
|
*p != Heap::null_value();
|
|
|
|
p = Handle<Object>(p->GetPrototype())) {
|
|
|
|
Handle<JSObject> current(JSObject::cast(*p));
|
|
|
|
|
2008-09-24 15:47:34 +00:00
|
|
|
// Check access rights if required.
|
|
|
|
if (current->IsAccessCheckNeeded() &&
|
|
|
|
!Top::MayNamedAccess(*current, Heap::undefined_value(),
|
|
|
|
v8::ACCESS_KEYS)) {
|
|
|
|
Top::ReportFailedAccessCheck(*current, v8::ACCESS_KEYS);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2008-07-03 15:10:15 +00:00
|
|
|
// Compute the element keys.
|
|
|
|
Handle<FixedArray> element_keys =
|
|
|
|
Factory::NewFixedArray(current->NumberOfEnumElements());
|
|
|
|
current->GetEnumElementKeys(*element_keys);
|
|
|
|
content = UnionOfKeys(content, element_keys);
|
|
|
|
|
|
|
|
// Add the element keys from the interceptor.
|
|
|
|
if (current->HasIndexedInterceptor()) {
|
|
|
|
v8::Handle<v8::Array> result =
|
|
|
|
GetKeysForIndexedInterceptor(object, current);
|
|
|
|
if (!result.IsEmpty())
|
|
|
|
content = AddKeysFromJSArray(content, v8::Utils::OpenHandle(*result));
|
|
|
|
}
|
2009-04-16 11:30:55 +00:00
|
|
|
|
|
|
|
// Compute the property keys.
|
|
|
|
content = UnionOfKeys(content, GetEnumPropertyKeys(current));
|
|
|
|
|
|
|
|
// Add the property keys from the interceptor.
|
|
|
|
if (current->HasNamedInterceptor()) {
|
|
|
|
v8::Handle<v8::Array> result =
|
|
|
|
GetKeysForNamedInterceptor(object, current);
|
|
|
|
if (!result.IsEmpty())
|
|
|
|
content = AddKeysFromJSArray(content, v8::Utils::OpenHandle(*result));
|
|
|
|
}
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return content;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<JSArray> GetKeysFor(Handle<JSObject> object) {
|
|
|
|
Counters::for_in.Increment();
|
2008-10-09 13:34:17 +00:00
|
|
|
Handle<FixedArray> elements = GetKeysInFixedArrayFor(object);
|
|
|
|
return Factory::NewJSArrayWithElements(elements);
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Handle<FixedArray> GetEnumPropertyKeys(Handle<JSObject> object) {
|
|
|
|
int index = 0;
|
|
|
|
if (object->HasFastProperties()) {
|
|
|
|
if (object->map()->instance_descriptors()->HasEnumCache()) {
|
|
|
|
Counters::enum_cache_hits.Increment();
|
|
|
|
DescriptorArray* desc = object->map()->instance_descriptors();
|
|
|
|
return Handle<FixedArray>(FixedArray::cast(desc->GetEnumCache()));
|
|
|
|
}
|
|
|
|
Counters::enum_cache_misses.Increment();
|
|
|
|
int num_enum = object->NumberOfEnumProperties();
|
|
|
|
Handle<FixedArray> storage = Factory::NewFixedArray(num_enum);
|
|
|
|
Handle<FixedArray> sort_array = Factory::NewFixedArray(num_enum);
|
2009-07-10 19:25:18 +00:00
|
|
|
Handle<DescriptorArray> descs =
|
|
|
|
Handle<DescriptorArray>(object->map()->instance_descriptors());
|
|
|
|
for (int i = 0; i < descs->number_of_descriptors(); i++) {
|
|
|
|
if (descs->IsProperty(i) && !descs->IsDontEnum(i)) {
|
|
|
|
(*storage)->set(index, descs->GetKey(i));
|
|
|
|
PropertyDetails details(descs->GetDetails(i));
|
|
|
|
(*sort_array)->set(index, Smi::FromInt(details.index()));
|
2008-07-03 15:10:15 +00:00
|
|
|
index++;
|
|
|
|
}
|
|
|
|
}
|
2009-04-16 11:30:55 +00:00
|
|
|
(*storage)->SortPairs(*sort_array, sort_array->length());
|
2008-07-03 15:10:15 +00:00
|
|
|
Handle<FixedArray> bridge_storage =
|
|
|
|
Factory::NewFixedArray(DescriptorArray::kEnumCacheBridgeLength);
|
|
|
|
DescriptorArray* desc = object->map()->instance_descriptors();
|
|
|
|
desc->SetEnumCache(*bridge_storage, *storage);
|
|
|
|
ASSERT(storage->length() == index);
|
|
|
|
return storage;
|
|
|
|
} else {
|
|
|
|
int num_enum = object->NumberOfEnumProperties();
|
|
|
|
Handle<FixedArray> storage = Factory::NewFixedArray(num_enum);
|
|
|
|
Handle<FixedArray> sort_array = Factory::NewFixedArray(num_enum);
|
|
|
|
object->property_dictionary()->CopyEnumKeysTo(*storage, *sort_array);
|
|
|
|
return storage;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
bool CompileLazyShared(Handle<SharedFunctionInfo> shared,
|
2008-11-17 05:50:52 +00:00
|
|
|
ClearExceptionFlag flag,
|
|
|
|
int loop_nesting) {
|
2008-07-03 15:10:15 +00:00
|
|
|
// Compile the source information to a code object.
|
|
|
|
ASSERT(!shared->is_compiled());
|
2008-11-17 05:50:52 +00:00
|
|
|
bool result = Compiler::CompileLazy(shared, loop_nesting);
|
2008-07-03 15:10:15 +00:00
|
|
|
ASSERT(result != Top::has_pending_exception());
|
|
|
|
if (!result && flag == CLEAR_EXCEPTION) Top::clear_pending_exception();
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
bool CompileLazy(Handle<JSFunction> function, ClearExceptionFlag flag) {
|
|
|
|
// Compile the source information to a code object.
|
|
|
|
Handle<SharedFunctionInfo> shared(function->shared());
|
2008-11-17 05:50:52 +00:00
|
|
|
return CompileLazyShared(shared, flag, 0);
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2008-11-17 05:50:52 +00:00
|
|
|
bool CompileLazyInLoop(Handle<JSFunction> function, ClearExceptionFlag flag) {
|
|
|
|
// Compile the source information to a code object.
|
|
|
|
Handle<SharedFunctionInfo> shared(function->shared());
|
|
|
|
return CompileLazyShared(shared, flag, 1);
|
|
|
|
}
|
|
|
|
|
2008-07-03 15:10:15 +00:00
|
|
|
OptimizedObjectForAddingMultipleProperties::
|
|
|
|
OptimizedObjectForAddingMultipleProperties(Handle<JSObject> object,
|
|
|
|
bool condition) {
|
|
|
|
object_ = object;
|
|
|
|
if (condition && object_->HasFastProperties()) {
|
|
|
|
// Normalize the properties of object to avoid n^2 behavior
|
|
|
|
// when extending the object multiple properties.
|
|
|
|
unused_property_fields_ = object->map()->unused_property_fields();
|
2009-01-12 10:59:58 +00:00
|
|
|
NormalizeProperties(object_, KEEP_INOBJECT_PROPERTIES);
|
2008-07-03 15:10:15 +00:00
|
|
|
has_been_transformed_ = true;
|
|
|
|
|
|
|
|
} else {
|
|
|
|
has_been_transformed_ = false;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
OptimizedObjectForAddingMultipleProperties::
|
|
|
|
~OptimizedObjectForAddingMultipleProperties() {
|
|
|
|
// Reoptimize the object to allow fast property access.
|
|
|
|
if (has_been_transformed_) {
|
|
|
|
TransformToFastProperties(object_, unused_property_fields_);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-04-24 08:13:09 +00:00
|
|
|
void LoadLazy(Handle<JSObject> obj, bool* pending_exception) {
|
2008-07-03 15:10:15 +00:00
|
|
|
HandleScope scope;
|
2009-04-24 08:13:09 +00:00
|
|
|
Handle<FixedArray> info(FixedArray::cast(obj->map()->constructor()));
|
2008-07-03 15:10:15 +00:00
|
|
|
int index = Smi::cast(info->get(0))->value();
|
|
|
|
ASSERT(index >= 0);
|
|
|
|
Handle<Context> compile_context(Context::cast(info->get(1)));
|
|
|
|
Handle<Context> function_context(Context::cast(info->get(2)));
|
|
|
|
Handle<Object> receiver(compile_context->global()->builtins());
|
|
|
|
|
|
|
|
Vector<const char> name = Natives::GetScriptName(index);
|
|
|
|
|
|
|
|
Handle<JSFunction> boilerplate;
|
|
|
|
|
|
|
|
if (!Bootstrapper::NativesCacheLookup(name, &boilerplate)) {
|
|
|
|
Handle<String> source_code = Bootstrapper::NativesSourceLookup(index);
|
|
|
|
Handle<String> script_name = Factory::NewStringFromAscii(name);
|
|
|
|
bool allow_natives_syntax = FLAG_allow_natives_syntax;
|
|
|
|
FLAG_allow_natives_syntax = true;
|
|
|
|
boilerplate = Compiler::Compile(source_code, script_name, 0, 0, NULL, NULL);
|
|
|
|
FLAG_allow_natives_syntax = allow_natives_syntax;
|
|
|
|
// If the compilation failed (possibly due to stack overflows), we
|
|
|
|
// should never enter the result in the natives cache. Instead we
|
|
|
|
// return from the function without marking the function as having
|
|
|
|
// been lazily loaded.
|
|
|
|
if (boilerplate.is_null()) {
|
|
|
|
*pending_exception = true;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
Bootstrapper::NativesCacheAdd(name, boilerplate);
|
|
|
|
}
|
|
|
|
|
|
|
|
// We shouldn't get here if compiling the script failed.
|
|
|
|
ASSERT(!boilerplate.is_null());
|
|
|
|
|
2009-04-20 16:36:13 +00:00
|
|
|
#ifdef ENABLE_DEBUGGER_SUPPORT
|
2008-07-03 15:10:15 +00:00
|
|
|
// When the debugger running in its own context touches lazy loaded
|
|
|
|
// functions loading can be triggered. In that case ensure that the
|
|
|
|
// execution of the boilerplate is in the correct context.
|
|
|
|
SaveContext save;
|
|
|
|
if (!Debug::debug_context().is_null() &&
|
|
|
|
Top::context() == *Debug::debug_context()) {
|
|
|
|
Top::set_context(*compile_context);
|
|
|
|
}
|
2009-04-20 16:36:13 +00:00
|
|
|
#endif
|
2008-07-03 15:10:15 +00:00
|
|
|
|
|
|
|
// Reset the lazy load data before running the script to make sure
|
|
|
|
// not to get recursive lazy loading.
|
2009-04-24 08:13:09 +00:00
|
|
|
obj->map()->set_needs_loading(false);
|
|
|
|
obj->map()->set_constructor(info->get(3));
|
2008-07-03 15:10:15 +00:00
|
|
|
|
|
|
|
// Run the script.
|
|
|
|
Handle<JSFunction> script_fun(
|
|
|
|
Factory::NewFunctionFromBoilerplate(boilerplate, function_context));
|
|
|
|
Execution::Call(script_fun, receiver, 0, NULL, pending_exception);
|
|
|
|
|
2009-04-24 08:13:09 +00:00
|
|
|
// If lazy loading failed, restore the unloaded state of obj.
|
|
|
|
if (*pending_exception) {
|
|
|
|
obj->map()->set_needs_loading(true);
|
|
|
|
obj->map()->set_constructor(*info);
|
|
|
|
}
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-04-24 08:13:09 +00:00
|
|
|
void SetupLazy(Handle<JSObject> obj,
|
2008-07-03 15:10:15 +00:00
|
|
|
int index,
|
|
|
|
Handle<Context> compile_context,
|
Split window support from V8.
Here is a description of the background and design of split window in Chrome and V8:
https://docs.google.com/a/google.com/Doc?id=chhjkpg_47fwddxbfr
This change list splits the window object into two parts: 1) an inner window object used as the global object of contexts; 2) an outer window object exposed to JavaScript and accessible by the name 'window'. Firefox did it awhile ago, here are some discussions: https://wiki.mozilla.org/Gecko:SplitWindow. One additional benefit of splitting window in Chrome is that accessing global variables don't need security checks anymore, it can improve applications that use many global variables.
V8 support of split window:
There are a small number of changes on V8 api to support split window:
Security context is removed from V8, so does related API functions;
A global object can be detached from its context and reused by a new context;
Access checks on an object template can be turned on/off by default;
An object can turn on its access checks later;
V8 has a new object type, ApiGlobalObject, which is the outer window object type. The existing JSGlobalObject becomes the inner window object type. Security checks are moved from JSGlobalObject to ApiGlobalObject. ApiGlobalObject is the one exposed to JavaScript, it is accessible through Context::Global(). ApiGlobalObject's prototype is set to JSGlobalObject so that property lookups are forwarded to JSGlobalObject. ApiGlobalObject forwards all other property access requests to JSGlobalObject, such as SetProperty, DeleteProperty, etc.
Security token is moved to a global context, and ApiGlobalObject has a reference to its global context. JSGlobalObject has a reference to its global context as well. When accessing properties on a global object in JavaScript, the domain security check is performed by comparing the security token of the lexical context (Top::global_context()) to the token of global object's context. The check is only needed when the receiver is a window object, such as 'window.document'. Accessing global variables, such as 'var foo = 3; foo' does not need checks because the receiver is the inner window object.
When an outer window is detached from its global context (when a frame navigates away from a page), it is completely detached from the inner window. A new context is created for the new page, and the outer global object is reused. At this point, the access check on the DOMWindow wrapper of the old context is turned on. The code in old context is still able to access DOMWindow properties, but it has to go through domain security checks.
It is debatable on how to implement the outer window object. Currently each property access function has to check if the receiver is ApiGlobalObject type. This approach might be error-prone that one may forget to check the receiver when adding new functions. It is unlikely a performance issue because accessing global variables are more common than 'window.foo' style coding.
I am still working on the ARM port, and I'd like to hear comments and suggestions on the best way to support it in V8.
Review URL: http://codereview.chromium.org/7366
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@540 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-21 19:07:58 +00:00
|
|
|
Handle<Context> function_context) {
|
2009-04-24 08:13:09 +00:00
|
|
|
Handle<FixedArray> arr = Factory::NewFixedArray(4);
|
2008-07-03 15:10:15 +00:00
|
|
|
arr->set(0, Smi::FromInt(index));
|
|
|
|
arr->set(1, *compile_context); // Compile in this context
|
|
|
|
arr->set(2, *function_context); // Set function context to this
|
2009-04-24 08:13:09 +00:00
|
|
|
arr->set(3, obj->map()->constructor()); // Remember the constructor
|
|
|
|
Handle<Map> old_map(obj->map());
|
2009-04-24 12:45:29 +00:00
|
|
|
Handle<Map> new_map = Factory::CopyMapDropTransitions(old_map);
|
2009-04-24 08:13:09 +00:00
|
|
|
obj->set_map(*new_map);
|
|
|
|
new_map->set_needs_loading(true);
|
|
|
|
// Store the lazy loading info in the constructor field. We'll
|
|
|
|
// reestablish the constructor from the fixed array after loading.
|
|
|
|
new_map->set_constructor(*arr);
|
|
|
|
ASSERT(!obj->IsLoaded());
|
2008-07-03 15:10:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
} } // namespace v8::internal
|